Piteball
/
android_hardware_qcom_display
mirror of https://github.com/followmsi/android_hardware_qcom_display.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hwc2: hwc: Validate input parcel values for few qclient methods. 

Validate values read from input parcel as part of handling of
few qclient methods

Change-Id: Icf928f409a5c2ac76a73e95de58cb0ebc59d24d5
CRs-Fixed: 2114346
This commit is contained in:
Rohit Kulkarni 2017-09-26 16:36:21 -07:00 committed by Alain Vongsouvanh
parent b85c4c7be2
commit 8402b86cd9
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
msm8909w_3100/sdm/libs/hwc/hwc_session.cpp
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2014 - 2017, The Linux Foundation. All rights reserved.
* Copyright (c) 2014 - 2018, The Linux Foundation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
@ -1009,7 +1009,7 @@ android::status_t HWCSession::HandleGetDisplayAttributesForConfig(const android:
DisplayPort sdm_disp_port = kPortDefault;
int hwc_disp_port = qdutils::DISPLAY_PORT_DEFAULT;
if (dpy > HWC_DISPLAY_VIRTUAL) {
if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES || config < 0) {
return android::BAD_VALUE;
}
@ -1690,7 +1690,7 @@ android::status_t HWCSession::GetVisibleDisplayRect(const android::Parcel *input
android::Parcel *output_parcel) {
int dpy = input_parcel->readInt32();
if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES) {
return android::BAD_VALUE;;
}

10
msm8909w_3100/sdm/libs/hwc2/hwc_session.cpp
View File

@ -1031,7 +1031,7 @@ android::status_t HWCSession::HandleGetDisplayAttributesForConfig(const android:
int error = android::BAD_VALUE;
DisplayConfigVariableInfo display_attributes;
if (dpy > HWC_DISPLAY_VIRTUAL) {
if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES || config < 0) {
return android::BAD_VALUE;
}
@ -1177,6 +1177,11 @@ android::status_t HWCSession::SetColorModeOverride(const android::Parcel *input_
auto display = static_cast<hwc2_display_t >(input_parcel->readInt32());
auto mode = static_cast<android_color_mode_t>(input_parcel->readInt32());
auto device = static_cast<hwc2_device_t *>(this);
if (display >= HWC_NUM_DISPLAY_TYPES) {
return -EINVAL;
}
auto err = CallDisplayFunction(device, display, &HWCDisplay::SetColorMode, mode);
if (err != HWC2_ERROR_NONE)
return -EINVAL;
@ -1472,8 +1477,7 @@ android::status_t HWCSession::GetVisibleDisplayRect(const android::Parcel *input
SCOPE_LOCK(locker_);
int dpy = input_parcel->readInt32();
if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES) {
return android::BAD_VALUE;
}